Consolidate ASCS RHEL profiles lastlog via sshd

As E8 and ISM O profiles were using different methods to print last login information. This results in different timestamps in logs, creating inconvenience. Using just one method is preferrable.
ComplianceAsCode · Jul 31, 2024 · 5f9c3db · 5f9c3db
1 parent 4707824
commit 5f9c3db
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 4 deletions.
diff --git a/controls/ism_o.yml b/controls/ism_o.yml
@@ -116,7 +116,7 @@ controls:
             - audit_rules_privileged_commands
             - audit_rules_session_events
             - audit_rules_unsuccessful_file_modification
-            - display_login_attempts
+            - sshd_print_last_log
             - sebool_auditadm_exec_content
         status: automated
 
@@ -134,7 +134,7 @@ controls:
             - audit_rules_privileged_commands
             - audit_rules_session_events
             - audit_rules_unsuccessful_file_modification
-            - display_login_attempts
+            - sshd_print_last_log
             - sebool_auditadm_exec_content
         status: automated
 

diff --git a/products/rhel8/profiles/ism_o.profile b/products/rhel8/profiles/ism_o.profile
@@ -101,7 +101,7 @@ selections:
 
   ## Events to be logged
   ## Identifiers 0580 / 0584 / 0582 / 0585 / 0586 / 0846 / 0957
-  - display_login_attempts
+  - sshd_print_last_log
   - sebool_auditadm_exec_content
   - audit_rules_privileged_commands
   - audit_rules_session_events

diff --git a/products/rhel9/profiles/ism_o.profile b/products/rhel9/profiles/ism_o.profile
@@ -101,7 +101,7 @@ selections:
 
   ## Events to be logged
   ## Identifiers 0580 / 0584 / 0582 / 0585 / 0586 / 0846 / 0957
-  - display_login_attempts
+  - sshd_print_last_log
   - sebool_auditadm_exec_content
   - audit_rules_privileged_commands
   - audit_rules_session_events